Anyscale has detailed a critical vulnerability, CVE-2025-62593, affecting versions of its Ray framework prior to 2.52.0. This vulnerability, which was patched in version 2.52.0 released on November 26, 2025, allows for arbitrary code execution on a user's machine through a combination of DNS rebinding and a bypassable User-Agent header check. CISA added this CVE to its Known Exploited Vulnerabilities catalog on August 17, 2026, mandating remediation by August 20, 2026, for federal agencies. Anyscale strongly recommends upgrading to version 2.52.0 or later and enabling token authentication for enhanced security. AI
IMPACT Users of the Ray framework must upgrade to version 2.52.0 or later and enable token authentication to mitigate arbitrary code execution risks.
RANK_REASON The item details a specific vulnerability and patch for a software framework, which falls under tool-related security advisories.
- 2.52.0
- Anyscale, Inc.
- August 17, 2026
- Binding Operational Directive 26-04
- Cisa
- CVE-2025-62593
- Fetch
- Firefox
- GHSA-q279-jhrf-cc6v
- Google Chrome
- Mozilla
- November 26, 2025
- Ray
- Safari
AI-generated summary · Google Gemini · from 1 sources. How we write summaries →
